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IN THE SPECIFICATION 

Pursuant to 37 CFR § L121(b)(l)(i)-(ii), please delete the paragraph on page 1, 
lines 5-7, and replace it with the following paragraph, which includes markings to show all 
the changes relative to the previous version of the paragraph: 

"The present application is a continuation-in-part of U.S. Patent Application Serial 
No. 09/309,755, filed May 11, 1999, now U.S. Patent No. 6.681,331. titled "Dynamic 
Software System Intrusion Detection," which is hereby incorporated by reference in its 
entirety." 

Pursuant to 37 CFR § 1.121(b)(l)(i)-(ii), please delete the paragraph on page 2, 
lines 18-31, and replace it with the following paragraph, which includes markings to show 
all the changes relative to the previous version of the paragraph: 

"A more general case of the intrusion detection problem is the problem of 
anomalous behavior detection. It is possible to detect anomalous behavior based on the 
. measurement of program activity as control is passed among program control structures. 
As a system executes its customary activities, the behavior monitoring scheme should 
estimate a nominal system behavior. Departures from the nominal system profile will likely 
represent potential anomalous activity on the system. Since unwanted activity may be 
detected by comparison of the current system activity to that occurring during previous 
assaults on the system, it would be desirable to store profiles for recognizing these 
activities from historical data. Historical data, however, cannot be used to recognize new 
kinds of behavior. An effective security tool would be one designed to recognize assaults 
as they occur through the understanding and comparison of the current behavior against 
nominal system activity. The subject matter disclosed herein and in U.S. Patent 
Application Serial No. 09/309,755 , now U.S. Patent No. 6.68L33L addresses these 
issues," 
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